Hacking cIOSX rev21d2x: Yet Another Hot Fix!!!!

[IceIceBird]

Don't know if somebody wrote it already, but We Dare (PAL) is working on d2x v6 beta 1 with IOS block reload on cfg Loader v69b1 started from USB with FAT partition.
Great work and thanks again to the whole team!

Btw: Installed d2x v6 beta with d2x installer 1.2 using IOS236 (236 installer v5) and it worked!

This was a Loader issue and not a cIOS issue (AP memory check). But this is fixed in most of the Loaders now i think

 

[davebaol]

@damysteryman
I've looked into ios code and actually those patches are for the IOP module which is in the kernel .app file along with ES and FFS modules.

Anyways, here is a new ESP module which applies those patches to IOP: http://www.multiupload.com/3L23RGFBFG

It should work for bases 37, 53, 55, 56, 57 and 58.

Just replace the old module in d2x v6beta1.

EDIT:
Forgot to say thanks

EDIT 2:
Module link replaced with a new one that supports more bases.
OK, I just tested this modified ES.app inside cIOS249[56]-v21d2x6-beta1 with both NeoGamma R9 beta 49 and CFG USB Loader 69b1, and.... did not work. Korean games still fail, and make the Wii hang...

...is there any way to actually check if the patches are being applied correctly (Such as a USB Gecko debug output or something)?

Hmmm... I believe the patches are applied correctly.
Here is how I do it:

Spoiler

CODE

Spoiler

/* Actual Korean key */
u32 actualKoreanKey[] = {0x63B82BB4, 0xF4614E2E, 0x13F2FEFB, 0xBA4C9B7E};

void __ReplaceDefaultKoreanKey(u32 addr)
{
ÂÂÂÂu32 cnt = 0;
ÂÂÂÂwhile (cnt>2]);
ÂÂÂÂÂÂÂÂcnt += 4;
ÂÂÂÂ}
}

// d2x v6 beta2
// Added to support Korean Common Key
void Patch_IopModule(u32 version)
{
ÂÂÂÂswitch (version) {
ÂÂÂÂ/** 07/11/08 14:34:29 **/
ÂÂÂÂ/** 03/01/10 03:28:58 **/
ÂÂÂÂcase 0x48776F75:ÂÂÂÂÂÂ// IOS: 37v5662, 53v5662, 55v5662

ÂÂÂÂÂÂÂÂ/* Patch 1 for Korean key */
ÂÂÂÂÂÂÂÂWrite8(0xFFFF1D30, 0xE0);

ÂÂÂÂÂÂÂÂ/* Patch 2 for Korean key */
ÂÂÂÂÂÂÂÂ__ReplaceDefaultKoreanKey(0xFFFF9914);

ÂÂÂÂÂÂÂÂbreak;

ÂÂÂÂ/** 12/23/08 17:28:32 **/
ÂÂÂÂcase 0x49511FC0:

ÂÂÂÂÂÂÂÂbreak;

ÂÂÂÂ/** 03/01/10 03:13:17 **/
ÂÂÂÂcase 0x4B8B30CD:ÂÂÂÂÂÂ// IOS: 38v4123

ÂÂÂÂÂÂÂÂ/* Patch 1 for Korean key */
ÂÂÂÂÂÂÂÂ//Write8(0xFFFF1D30, 0xE0);ÂÂWRONG

ÂÂÂÂÂÂÂÂ/* Patch 2 for Korean key */
ÂÂÂÂÂÂÂÂ//__ReplaceDefaultKoreanKey(0xFFFF9864);ÂÂGOOD
ÂÂÂÂÂÂÂÂbreak;

ÂÂÂÂ/** 11/24/08 15:39:12 **/
ÂÂÂÂ/** 06/03/09 07:49:12 **/
ÂÂÂÂ/** 03/03/10 10:43:18 **/
ÂÂÂÂcase 0x492ACAA0:
ÂÂÂÂcase 0x4B8E3D46:ÂÂÂÂÂÂ// IOS: 56v5661, 57v5918, 58v6175
ÂÂÂÂÂÂÂÂ/* Patch 1 for Korean key */
ÂÂÂÂÂÂÂÂWrite8(0xFFFF1EF8, 0xE0);

ÂÂÂÂÂÂÂÂ/* Patch 2 for Korean key */
ÂÂÂÂÂÂÂÂ__ReplaceDefaultKoreanKey(0xFFFF9B54);

ÂÂÂÂÂÂÂÂbreak;

ÂÂÂÂdefault:
ÂÂÂÂÂÂÂÂwrite("ESP: Error -> Can't patch IOP module (unknown version)\n");
ÂÂÂÂÂÂÂÂbreak;
ÂÂÂÂ}
}

And USB Gecko debug output for those addresses it's a mess.
That code is executed by mload that crashes if you try to print values.

I suspect that the patches are applied after the original code has been executed.
In fact the original code is executed as soon as IOP is loaded in memory and likely when ESP is loaded that IOP code has been executed already.
It works for you because you patch the binaries inside the wad.
I mean, your patch is static while mine is dynamic.

 

[Porobu]

No, Installer is not using AHBPROT even if I told Dragbe to do it because he considers it too buggy for people without internet connexion. I will try again if you want to

AHBPROT is really buggy without an internet connection... cosider as example that IOS236 installer v5 always gives errors with no internet connection, unless you are faster than light... IOS236 installer v5 mod works since it asks nothing and install the IOS236 suddenly before reaching the internet connection error...

Jskyboo fixed it in WiiMod

QUOTE(petspeed @ Feb 7 2011, 02:08 PM)

@jskyboo your program seems very interesting, I am definitely going to try it. I have one question for v2.0: What is the workaround for AHBPROT and does it work when launched from HBC without wifi?

Thank you for your work.

The workaround is very simple, at program launch it checks if you are currently in AHBPROT mode, if not continue as usual, but if you are in AHBPROT mode then test the network connection, if that passes then continue as usual but if it fails then prompt the user to reload to another IOS, it doesn't matter which you choose you can even choose IOS 58. After the reload the program continues as usual. It is a very simple workaround and it will have to be taken out once the bug is truly fixed. I don't actually know much about the cause, some have said it is from a bug in libogc that has been fixed but HBC hasn't been compiled with the fixed library so it has the bug in anything it launches. I don't know but til its fixed there is this workaround.

 

[TheRealVisitor]

Tested 249[56]d2x6beta1 wich CFG 069b1 on NTFS drive.

- We Dare runs
- Wii Sports Resort works
- Metal Slug Anthology works (MS6 starts from MS menu when using "Block IOS reload" setting in CFG)
- PoP - Sands of time works without "Patches on"-option.

Really really great job dave and all of the d2x team.

 

[stev418]

Tested MPT and Sam and Max on my FAT32 usb, all working nicely

 

[davebaol]

Ok, FIX94 successfully tested a new EHCI module for NTFS issue.

Rename it EHCI.app and replace the old module in d2x v6beta1 with this one:
http://www.multiupload.com/8A4CDBE8K2

Please test wiiflow cover issue too.

 

[damysteryman]

Hmmm... I believe the patches are applied correctly.
Here is how I do it:

Spoiler

CODE/* Actual Korean key */
u32 actualKoreanKey[] = {0x63B82BB4, 0xF4614E2E, 0x13F2FEFB, 0xBA4C9B7E};

void __ReplaceDefaultKoreanKey(u32 addr)
{
ÂÂÂÂu32 cnt = 0;
ÂÂÂÂwhile (cnt>2]);
ÂÂÂÂÂÂÂÂcnt += 4;
ÂÂÂÂ}
}

// d2x v6 beta2
// Added to support Korean Common Key
void Patch_IopModule(u32 version)
{
ÂÂÂÂswitch (version) {
ÂÂÂÂ/** 07/11/08 14:34:29 **/
ÂÂÂÂ/** 03/01/10 03:28:58 **/
ÂÂÂÂcase 0x48776F75:ÂÂÂÂÂÂ// IOS: 37v5662, 53v5662, 55v5662

ÂÂÂÂÂÂÂÂ/* Patch 1 for Korean key */
ÂÂÂÂÂÂÂÂWrite8(0xFFFF1D30, 0xE0);

ÂÂÂÂÂÂÂÂ/* Patch 2 for Korean key */
ÂÂÂÂÂÂÂÂ__ReplaceDefaultKoreanKey(0xFFFF9914);

ÂÂÂÂÂÂÂÂbreak;

ÂÂÂÂ/** 12/23/08 17:28:32 **/
ÂÂÂÂcase 0x49511FC0:

ÂÂÂÂÂÂÂÂbreak;

ÂÂÂÂ/** 03/01/10 03:13:17 **/
ÂÂÂÂcase 0x4B8B30CD:ÂÂÂÂÂÂ// IOS: 38v4123

ÂÂÂÂÂÂÂÂ/* Patch 1 for Korean key */
ÂÂÂÂÂÂÂÂ//Write8(0xFFFF1D30, 0xE0);ÂÂWRONG

ÂÂÂÂÂÂÂÂ/* Patch 2 for Korean key */
ÂÂÂÂÂÂÂÂ//__ReplaceDefaultKoreanKey(0xFFFF9864);ÂÂGOOD
ÂÂÂÂÂÂÂÂbreak;

ÂÂÂÂ/** 11/24/08 15:39:12 **/
ÂÂÂÂ/** 06/03/09 07:49:12 **/
ÂÂÂÂ/** 03/03/10 10:43:18 **/
ÂÂÂÂcase 0x492ACAA0:
ÂÂÂÂcase 0x4B8E3D46:ÂÂÂÂÂÂ// IOS: 56v5661, 57v5918, 58v6175
ÂÂÂÂÂÂÂÂ/* Patch 1 for Korean key */
ÂÂÂÂÂÂÂÂWrite8(0xFFFF1EF8, 0xE0);

ÂÂÂÂÂÂÂÂ/* Patch 2 for Korean key */
ÂÂÂÂÂÂÂÂ__ReplaceDefaultKoreanKey(0xFFFF9B54);

ÂÂÂÂÂÂÂÂbreak;

ÂÂÂÂdefault:
ÂÂÂÂÂÂÂÂwrite("ESP: Error -> Can't patch IOP module (unknown version)\n");
ÂÂÂÂÂÂÂÂbreak;
ÂÂÂÂ}
}

And USB Gecko debug output for those addresses it's a mess.
That code is executed by mload that crashes if you try to print values.

I suspect that the patches are applied after the original code has been executed.
In fact the original code is executed as soon as IOP is loaded in memory and likely when ESP is loaded that IOP code has been executed already.
It works for you because you patch the binaries inside the wad.
I mean, your patch is static while mine is dynamic.

Yeah, that is what I am thinking too.
But how do we check this to confirm?

Do you think it would be easier for the kernel .app to be physically patched by ModMii/d2x cIOS Installer instead? (despite it seeming "messier" , since it is not patched by the cIOS itself)
Or do you have another way that might work?

 

[davebaol]

@damysteryman
If our speculation is right then only cios installers and wad builders can do it.
Actually they already apply some patches like trucha.

 

[damysteryman]

@davebaol
Ah ok.
So it will have to be applied by the builder/installer the same way as the other basic patches like trucha, ES_Identify, NAND_permissions etc., meaning that they will have to be updated... That makes sense.

 

[TheRealVisitor]

Maybe its time to update first post and adding games that now work properly with d2x v6:

What I collected so far from this thread:
Ashley Cricket
Boogie
Call of Duty 3
CSI: Deadly Intent
CSI: Hard Evidence
CSI: Fatal Conspiracy
Emergency Mayhem
FIFA 08
Flingsmash (Newer Wii Motion Plus video)
Grand Slam Tennis (Wii Motion Plus video)
Indiana Jones: The Staff Of Kings (Fate of Atlantis game)
Madden 07
Madden 08
Medal of Honor Heroes 2
Metal Slug Anthology
Metroid Prime 1
Metroid Prime 2
Metroid Prime Trilogy
Mortal Kombat Armageddon
Mysims Collection
NBA Live 08
Price Is Right 2010
Prince of Persia - Sands of time ("Patches on" not needed anymore)
Raving Rabbits Party Collection
Red Steel
Red Steel 2 (Wii Motion Plus Video)
Sam & Max Season 1
Sam & Max Season 2
Sims 3 (Multiplayer)
Scene It Bright Lights
Splinter Cell Double Agent
SSX Blur
The House of The Dead 2 & 3 Return
Wii Sports Resort (Wii Motion Plus video)

 

[davebaol]

@TheRealVisitor
We Dare work just because cfg loader and neogamma counteract the AP-protection.
And AFAIK ios reload block supports all games out there.

 

[Spongeroberto]

Maybe its time to update first post and adding games that now work properly with d2x v6:

What I collected so far from this thread:
...
Red Steel 2 (Wii Motion Plus Video)
Sam & Max Season 1
Sam & Max Season 2
...

With d2x v6 beta 1 and cfg loader 69b1 sam and max season 1 plays no different from how it used to with my setup of a couple of months old. Namely, the game works fine as long as you enable alt dol. The actual game menu only brings you back to your system menu.

So, I don't see a reason to put it in the list.

 

[NutNut]

No, Installer is not using AHBPROT even if I told Dragbe to do it because he considers it too buggy for people without internet connexion. I will try again if you want to

AHBPROT is really buggy without an internet connection... cosider as example that IOS236 installer v5 always gives errors with no internet connection, unless you are faster than light... IOS236 installer v5 mod works since it asks nothing and install the IOS236 suddenly before reaching the internet connection error...

Jskyboo fixed it in WiiMod
QUOTE(jskyboo @ Feb 8 2011, 01:28 AM)

bug in libogc has been fixed but HBC hasn't been compiled with the fixed library so it has the bug in anything it launches. I don't know but til its fixed there is this workaround.

No he has not fixed the bug ^^

 

[Etheboss]

Ok, FIX94 successfully tested a new EHCI module for NTFS issue.

Rename it EHCI.app and replace the old module in d2x v6beta1 with this one:
http://www.multiupload.com/8A4CDBE8K2

Please test wiiflow cover issue too.

Ripping games to NTFS in CFG works with this..

 

[Etheboss]

Maybe its time to update first post and adding games that now work properly with d2x v6:

What I collected so far from this thread:
...
Red Steel 2 (Wii Motion Plus Video)
Sam & Max Season 1
Sam & Max Season 2
...

With d2x v6 beta 1 and cfg loader 69b1 sam and max season 1 plays no different from how it used to with my setup of a couple of months old. Namely, the game works fine as long as you enable alt dol. The actual game menu only brings you back to your system menu.

So, I don't see a reason to put it in the list.

That is the whole point, it should be on the list because it is a game that does not run out of the box and needs an ALT DOL method to run.

Maybe the question is, do we need a list...

 

[davebaol]

@Etheboss
Ok thanks for testing.
Can you also check wiiflow cover issue?

 

[OverjoY]

If you make the call to enable the new "block IOS reload" it always returns 0 no matter what values you send and if the patch is applied or not is this correct?

I'm trying to use the patch. First I used my own custom code and now the exact code from the first post, but it doesn't work in both ways. I asume if the patch is applied and the game runs that the cIOS takes care of the rest.

 

[Etheboss]

@Etheboss
Ok thanks for testing.
Can you also check wiiflow cover issue?

I can confirm downloading /saving covers is working now with Wiiflow..

 

[mamule]

Rename it EHCI.app and replace the old module in d2x v6beta1 with this one:
http://www.multiupload.com/8A4CDBE8K2

Please test wiiflow cover issue too.

I also confirm, it works to DL covers and make wfc

I use wiiflow_250 R254 with cIOS250[57]-v21d2x6-beta1 with this EHCI module... all my games are on "defaut" in IOS menu but if I change this parameter, "defaut" disappears... there are no more than my other cIOS

ps: Is since the V3 that this problem appeared

 

[Hielkenator]

Maybe its time to update first post and adding games that now work properly with d2x v6:

What I collected so far from this thread:
Ashley Cricket
Boogie
Call of Duty 3
CSI: Deadly Intent
CSI: Hard Evidence
CSI: Fatal Conspiracy
Emergency Mayhem
FIFA 08
Flingsmash (Newer Wii Motion Plus video)
Grand Slam Tennis (Wii Motion Plus video)
Indiana Jones: The Staff Of Kings (Fate of Atlantis game)
Madden 07
Madden 08
Medal of Honor Heroes 2
Metal Slug Anthology
Metroid Prime 1
Metroid Prime 2
Metroid Prime Trilogy
Mortal Kombat Armageddon
Mysims Collection
NBA Live 08
Price Is Right 2010
Prince of Persia - Sands of time ("Patches on" not needed anymore)
Raving Rabbits Party Collection
Red Steel
Red Steel 2 (Wii Motion Plus Video)
Sam & Max Season 1
Sam & Max Season 2
Sims 3 (Multiplayer)
Scene It Bright Lights
Splinter Cell Double Agent
SSX Blur
The House of The Dead 2
The House of The Dead 3
We Dare
Wii Sports Resort (Wii Motion Plus video)

Is actually one gamedisc and is called house of the dead 2 & 3 return"
Both games are choosable without the al'.dol method now. COOL!